Locking Down Microsoft 365 Sign-Ins
Last verified: October 2026
Microsoft gives you a free switch — Security Defaults — that blocks most account takeovers by forcing MFA and shutting off old sign-in methods. Here's how to turn it on and protect your admins. Rather have a hand? My number is (330) 200-8042.
Microsoft 365 Sign-In Security, at a Glance
If your business runs on Microsoft 365, your sign-ins are the front door to everything — and most account takeovers are just a stolen or guessed password. Microsoft gives small businesses a free answer called Security Defaults, built into Microsoft Entra ID (formerly Azure AD). One switch forces everyone to set up MFA, requires MFA for admins, and blocks old legacy sign-in methods attackers love. This guide walks you through turning it on, protecting your Global Administrator account, keeping a break-glass admin so you never get locked out, and knowing when the paid Conditional Access option is actually worth it. Setting names and paths move, so confirm them in your current admin center. There's a printable 29-page version up top.
Common Questions
1 What is Security Defaults?
A free baseline built into Microsoft Entra ID (formerly Azure AD) and included with Microsoft 365. Turning it on forces every user to register for MFA (the Microsoft Authenticator app), requires MFA for admin accounts, and blocks legacy authentication — old sign-in methods that can't do MFA.
2 How do I turn it on?
As of writing: sign in to the Microsoft Entra admin center as a Global Administrator, go to Identity > Overview > Properties, find Manage security defaults, and set it to Enabled. Microsoft moves these menus, so if yours differs, confirm in your current admin center.
3 Why protect the Global Administrator account?
Because it can change everything — add and remove people, read any mailbox, reset passwords, rewrite security. It's the keys to the kingdom. Put MFA on it, use a strong unique password, and don't read daily email from it. Microsoft has been making MFA mandatory for admin sign-ins.
4 What's a break-glass admin?
A spare Global Administrator account you create, write down, and lock away — never used day to day. It's there for the moment a regular admin is locked out or compromised, so you always have a clean way back in. Protect it with MFA and test it a couple of times a year.
5 Should I use Security Defaults or Conditional Access?
For most small businesses, Security Defaults — it's free and covers the essentials. Conditional Access is a more flexible, rule-based option but needs a paid Entra ID P1/P2 license and someone to manage it. You use one or the other, not both at once.
6 Will MFA constantly interrupt my team?
Less than people fear. On trusted devices you won't be prompted every time — it's a quick tap or a short number now and then. Give your team a day's heads-up before you turn it on and the rollout goes smoothly.
Would You Rather I Just Help?
Locking down Microsoft 365 is exactly the kind of quick, high-value job I love — an afternoon and your email and files are far safer, with nothing to sell you (I don't sell Microsoft licenses). I'll turn on Security Defaults, get everyone onto the Authenticator app, protect your Global Admin, and set up a break-glass account so nobody gets locked out. $99 flat for a visit, 30-day come-back-free. I'm a tech helper — just honest advice.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).